@orion-agents/orion-code 0.3.21 → 0.3.22

package/CHANGELOG.md

@@ -22,13 +22,27 @@ which is **not** a pass.
 
 ## [Unreleased]
 
-## [0.3.21] — UNRELEASED
+## [0.3.22] — UNRELEASED
 
-> **Status: candidate.** Open. Adds user-authorized local project-root discovery to
-> `LOCAL WORKSPACE` (bounded scan, explicit inspect → confirm → activate reuse, no
-> Home/network-volume scanning, no silent registration) and corrects the v0.3.20
-> release-facts documentation (`docs/plan/evidence/v0.3.20-e2e/release-receipt-v0.3.20.md`).
-> Not merged, tagged or published.
+> **Status: candidate.** Open. Agent Reliability & Efficiency — hardens ToolGateway
+> in-flight request identity (T22-01), adds the durability fault-injection matrix (T22-02),
+> the four-state release verification gate (T22-03), and a real coding-task evaluation
+> harness (T22-04). Plan: `docs/plan/v0.3.22-plan.md`. Not merged, tagged or published.
+
+### Fixed (product)
+
+- ToolGateway in-flight dedupe now compares the full request digest: the same invocationId
+  with different arguments, tool, snapshot, or parent conflicts
+  (`ORION_TOOL_INVOCATION_CONFLICT`) instead of reusing the running execution's promise.
+
+## [0.3.21] — 2026-10-09
+
+> **Status: published.** Released as `@orion-agents/orion-code@0.3.21` from
+> `refs/tags/v0.3.21`, and merged to `main` as `0d22c9a` (#264). Adds user-authorized
+> local project-root discovery to `LOCAL WORKSPACE` (bounded scan, explicit
+> inspect → confirm → activate reuse, no Home/network-volume scanning, no silent
+> registration) and corrects the v0.3.20 release-facts documentation
+> (`docs/plan/evidence/v0.3.20-e2e/release-receipt-v0.3.20.md`).
 
 ### Added (planned)
 

package/README.md

@@ -2,10 +2,9 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.21 candidate — open. Adds user-authorized local project-root discovery to
-> `LOCAL WORKSPACE` (bounded scan, explicit inspect → confirm → activate reuse). The previous
-> release 0.3.20 is on npm (registry `latest`) and tagged `v0.3.20` (`e658932`, #261) —
-> release facts: `docs/plan/evidence/v0.3.20-e2e/release-receipt-v0.3.20.md`.
+> v0.3.22 candidate — open. Hardens agent reliability (ToolGateway in-flight request
+> identity) and builds a real coding-task evaluation harness. The previous release 0.3.21
+> is on npm (registry `latest`) and tagged `v0.3.21` (`0d22c9a`, #264).
 
 [中文说明](README.zh-CN.md) ·
 [v0.3.7 plan](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
@@ -170,7 +169,7 @@ current development environments. Node 20 is upstream EOL and is no longer a v0.
 After the immutable `0.3.5` npm receipt exists:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.21
+npm install -g @orion-agents/orion-code@0.3.22
 orion --version
 orion doctor
 ```

package/README.zh-CN.md

@@ -2,9 +2,8 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.21 候选版本：进行中。为 `LOCAL WORKSPACE` 增加用户显式授权的项目根目录发现（有界
-> 扫描、复用 inspect → confirm → activate）。上一版 0.3.20 已发布 npm（registry `latest`）
-> 并打 tag `v0.3.20`（`e658932`，#261）——发布事实：`docs/plan/evidence/v0.3.20-e2e/release-receipt-v0.3.20.md`。
+> v0.3.22 候选版本：进行中。强化 Agent 可靠性（ToolGateway 执行中请求身份）并建设真实编码
+> 任务评测体系。上一版 0.3.21 已发布 npm（registry `latest`）并打 tag `v0.3.21`（`0d22c9a`，#264）。
 
 [English](README.md) ·
 [v0.3.7 方案](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
@@ -101,7 +100,7 @@ Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 当 npm 已存在不可变的 `0.3.4` 发布凭据后：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.21
+npm install -g @orion-agents/orion-code@0.3.22
 orion --version
 orion doctor
 ```

package/dist/runtime/tool-gateway.d.ts

@@ -140,6 +140,12 @@ export declare class ToolGatewayError extends Error {
 /** Capability → Policy → Approval → Sandbox → Execute → durable terminal receipt. */
 export declare class ToolGateway {
     private readonly services;
+    /**
+     * v0.3.22 T22-01 — in-flight entries carry the full request digest so the
+     * same invocationId with different arguments, tool, snapshot, or parent
+     * conflicts instead of silently reusing the first execution's promise
+     * (matching the durable journal's guard strength).
+     */
     private readonly inflight;
     private readonly clock;
     constructor(services: ToolGatewayServicesV1);

package/dist/runtime/tool-gateway.js

@@ -19,16 +19,38 @@ exports.ToolGatewayError = ToolGatewayError;
 class ToolGateway {
     constructor(services) {
         this.services = services;
+        /**
+         * v0.3.22 T22-01 — in-flight entries carry the full request digest so the
+         * same invocationId with different arguments, tool, snapshot, or parent
+         * conflicts instead of silently reusing the first execution's promise
+         * (matching the durable journal's guard strength).
+         */
         this.inflight = new Map();
         this.clock = services.clock ?? Date.now;
     }
     invoke(invocation) {
+        const requestDigest = computeRequestDigest(invocation);
         const existing = this.inflight.get(invocation.invocationId);
-        if (existing)
-            return existing;
-        const run = this.invokeOnce(invocation).finally(() => this.inflight.delete(invocation.invocationId));
-        this.inflight.set(invocation.invocationId, run);
-        return run;
+        if (existing) {
+            if (existing.requestDigest !== requestDigest) {
+                // Reject (rather than throw synchronously) so callers awaiting the
+                // invocation observe the conflict through the same promise channel as
+                // the durable-journal conflict.
+                return Promise.reject(new ToolGatewayError('ORION_TOOL_INVOCATION_CONFLICT', 'Invocation ID is already executing with different arguments or snapshot', invocation.invocationId));
+            }
+            return existing.promise;
+        }
+        const promise = this.invokeOnce(invocation).finally(() => {
+            // Remove only our own entry: the guard keeps a defensive barrier against
+            // deleting an entry created by a later invocation after this run
+            // finished.
+            const current = this.inflight.get(invocation.invocationId);
+            if (current && current.requestDigest === requestDigest) {
+                this.inflight.delete(invocation.invocationId);
+            }
+        });
+        this.inflight.set(invocation.invocationId, { requestDigest, promise });
+        return promise;
     }
     async invokeOnce(invocation) {
         validateInvocation(invocation);
@@ -237,8 +259,13 @@ function createStaticApprovalDecisionV1(input) {
 function createSandboxPreparationV1(input) {
     return deepFreeze({ ...input, digest: (0, canonical_1.digestRuntimeValue)(input) });
 }
-function createIntent(invocation, startedAt) {
-    const requestDigest = (0, canonical_1.digestRuntimeValue)({
+/**
+ * v0.3.22 T22-01 — the authoritative request identity, shared by the durable
+ * intent and the in-flight dedupe map. Excludes startedAt so identity stays
+ * stable across retries within one execution.
+ */
+function computeRequestDigest(invocation) {
+    return (0, canonical_1.digestRuntimeValue)({
         invocationId: invocation.invocationId,
         parentInvocationId: invocation.parentInvocationId,
         threadId: invocation.snapshot.threadId,
@@ -248,6 +275,9 @@ function createIntent(invocation, startedAt) {
         snapshotDigest: invocation.snapshot.digest,
         argsDigest: (0, canonical_1.digestRuntimeValue)(invocation.args),
     });
+}
+function createIntent(invocation, startedAt) {
+    const requestDigest = computeRequestDigest(invocation);
     const content = {
         version: 1,
         invocationId: invocation.invocationId,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@orion-agents/orion-code",
-  "version": "0.3.21",
+  "version": "0.3.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@orion-agents/orion-code",
-      "version": "0.3.21",
+      "version": "0.3.22",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^0.7.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-agents/orion-code",
-  "version": "0.3.21",
+  "version": "0.3.22",
   "description": "Orion Code - local-first goal-driven coding agent for terminal and Web.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",